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Reply to Office Action of October 4, 2005 

REMARKS/ARGUMENTS 

Claims 1-32 are pending in the present application. Claims 22-34 have been withdrawn 
from consideration due to a restriction/election requirement. Claims 1-21 have been rejected. 
Claims 1 and 21 have been amended. 

Applicants respectfully respond to this Office Action. 

A. Change of Correspondence Address 

A Change of Correspondence Address was filed in the present case on November 10, 
2004. A postcard for the Change of Correspondence Address was date stamped by the United 
States Patent and Trademark Office on November 15, 2004. Copies of the Change of 
Correspondence Address and the date-stamped postcard are included herewith in Appendix A. 
Applicants request that the U.S. Patent Office change the correspondence address as requested 
by the documents that were previously filed. 

B. Affirmation of Election 

Applicants hereby affirm the election of Group 1, claims 1-21, without traverse. 

C. Drawings 

The Office Action asked for a "Prior Art" legend to be added to Figures 1 and 2. 
Applicants respectfully request that the Examiner withdraw this request for the following 
reasons. 

Figure 1 is a "block diagram of the major hardware components of a computer used with 
the embodiments." Patent Application, Page 6, lines 8-9. The claims include elements that are 
illustrated in the exemplary embodiment in Figure 1. For example, claim 1 includes "memory of 
the computer to obtain memory data." The memory and the computer are both illustrated in one 
exemplary embodiment of Figure 1. Claim 23 also includes "a processor", which is illustrated in 
one exemplary embodiment shown in Figure 1. Thus, the exemplary embodiment shown in 
Figure 1 is illustrated and discussed in relation to Applicant's invention. 
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With respect to Figure 2, the claims include elements that are illustrated in or that relate 
to the exemplary embodiment in Figure 2. Furthermore, Applicants stated that "Figure 2 is a 
data and software block diagram that illustrates the typical interactions and interfaces an 
observing or monitoring computer program has." Patent Application, Page 6, lines 10-1 1. 
However, Applicants did not represent that the embodiment shown in Figure 2 is prior art. 
Applicants made no such representation and cannot make such a representation now. In the 
detailed description Applicants noted that "one observer program now commercially available is 
the Investigator product offered by Win What Where." Patent Application, Page 11, lines 12-13. 
"Others include Omniquad Desktop Surveillance, WinGuardian, and Stealth Keyboard 
Interceptor." Patent Application, Page 11, lines 13-14. These are examples of observer 
programs. However, Applicants do not know whether the embodiment shown in Figure 2, 
including all of the elements shown in Figure 2, is implemented by any of the observer programs 
and/or is implemented by any of the observer programs in the way it is shown in Figure 2. By 
placing "Prior Art" on a drawing Applicants are representing that "only that which is old is 
illustrated." See M.P.E.P. § 608.02(g). Because Applicants do not know with certainty whether 
what is illustrated in Figure 2 is prior art, Applicants ask that the Examiner kindly withdraw this 
requirement. 

Applicants respectfully request that the Examiner withdraw the request to add "Prior Art" 
legends to Figures 1 and 2 for the reasons set forth above. 

D. Claims 1-21 Rejected under 35 U.S.C. § 101 

The Examiner rejected claims 1-21 under 35 U.S.C. § 101 because "the subject matter of 
the above noted claims refers to a computer program that is not stated as being contained within 
any tangible medium." Office Action, Page 4. Claims 1-21 have been amended to include 
"embodied in a computer-readable medium." 
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E. Rejection of Claims 1-21 Under 35 U.S.C § 103(a) 

The Examiner rejected claims 1-21 under 35 U.S.C. § 103(a) based on Togawa, U.S. 
Patent No. 6,240,530 (hereinafter, "Togawa"), and further in view of Drake, U.S. Patent No. 
6,006,328 (hereinafter, "Drake"). This rejection is respectfully traversed. 

The M.P.E.P. states that 

To establish a prima facie case of obviousness, three basic criteria must be met. First, 
there must be some suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify the reference or to 
combine reference teachings. Second, there must be a reasonable expectation of success. 
Finally, the prior art reference (or references when combined) must teach or suggest all the 
claim limitations. The teaching or suggestion to make the claimed combination and the 
reasonable expectation of success must both be found in the prior art, and not based on 
applicant's disclosure. 

The initial burden is on the examiner to provide some suggestion of the desirability of 
doing what the inventor has done. To support the conclusion that the claimed invention is 
directed to obvious subject matter, either the references must expressly or impliedly suggest, 
the claimed invention or the examiner must present a convincing line of reasoning as to why 
the artisan would have found the claimed invention to have been obvious in light of the 
teachings of the references. 

M.P.E.P. §2142. 

Applicants respectfully submit that the claims at issue are patentably distinct from 
Togawa in view of Drake. Neither Togawa nor Drake teach or suggest all of the limitations in 
the claims. 

Claim 1 recites "observer data comprising a plurality of observer program characteristics 
descriptive of a plurality of observer programs where the observer programs are programmed to 
observe activities on a computer system and to create log data." Togawa does not teach or 
suggest this claim limitation. The Office Action has cited portions of Togawa and Drake as 
teaching or suggesting these claim elements. Each of these portions cited will be addressed in 
turn. 

The Office Action cited Togawa, Figure 1, si in relation to this claim limitation. Figure 
1 of Togawa is a flow diagram and si is a "virus detection and identification step." Togawa, 
Figure 1. This does not teach or suggest "observer data comprising a plurality of observer 
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program characteristics descriptive of a plurality of observer programs where the observer 

programs are programmed to observe activities on a computer system and to create log data." 

The Office Action also cited Col. 5, lines 10-19 of Togawa in relation to this claim 

limitation. The portion of Togawa states the following: 

According to a further aspect of the present invention, there is provided an 
information processing apparatus which includes a memory for storing programs 
and data for information processing and a processing section for executing the 
programs to perform various information processing, comprising a virus detection 
and identification section for detecting a computer virus which infects the 
information processing apparatus and identifying a type of the detected computer 
virus, a virus type information registration section for registering information 
regarding the type of the detected computer virus identified by the virus detection 
and identification section into a storage area which is access-disabled in an 
ordinary operation of the information processing apparatus . . . 

Togawa, Col. 5, lines 7-19. This does not teach or suggest "observer data comprising a plurality 
of observer program characteristics descriptive of a plurality of observer programs where the 
observer programs are programmed to observe activities on a computer system and to create log 
data." All of the claim limitations must be considered. This portion of Togawa teaches virus 
detection. However, it does not teach or suggest "observer data", nor does it teach or suggest 
"observer data comprising a plurality of observer program characteristics", nor does it teach or 
suggest "observer program characteristics descriptive of a plurality of observer programs", etc. 
Each of the claim limitations must be taught or suggested in the prior art references. None of the 
following limitations are taught or suggested in this portion of Togawa: "observer data 
comprising a plurality of observer program characteristics descriptive of a plurality of observer 
programs where the observer programs are programmed to observe activities on a computer 
system and to create log data." 

The Office Action also cited Drake, Figures 4, 5 and Col. 3, lines 31-52, in relation to this 
claim limitation. The portion in Col. 3 of Drake states the following: 

This invention seeks to provide computer software having enhanced 
security features, to a process which substantially enhances the security of 
computer software (hereafter referred to as the improved process) and to a method 
by which to apply said improved process (hereafter referred to as the applicator). 

The improved process consists of including computer code to 
automatically detect tampering of said computer software, and computer code to 
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prevent the theft of ID-Data by replacing existing vulnerable (to rogue software 
eavesdropping or attack) software or operating system code with secure 
equivalents which utilise anti-spy techniques (as described later in this document). 

Preferably, the improved process also consists of including computer code 
to prevent decompilation, reverse-engineering, and disassembly by the inclusion 
of obfuscating code inserts, and the use of executable encryption. 

Preferably, the improved process also consists of including code to 
prevent execution-tracing and debugging by the use of code designed to detect 
and prevent these operations. 

Drake, Col. 3, lines 31-52. 

This portion of Drake does not teach or suggest "observer data comprising a plurality of 
observer program characteristics descriptive of a plurality of observer programs where the 
observer programs are programmed to observe activities on a computer system and to create log 
data." It does mention "rogue software eavesdropping" (Col. 3, lines 41-42) and "anti-spy 
techniques" (Col. 3, lines 43), but these generic terms do not teach or suggest these claim 
elements. Figure 4 of Drake illustrates the known operation of a rogue eavesdropping program. 
Drake, Col. 4, lines 13-14. Figure 5 of Drake illustrates the interaction of the components of the 
updated application. Drake, Col. 4, lines 15-16. Claim 1 specifically requires "observer data 
comprising a plurality of observer program characteristics descriptive of a plurality of observer 
programs where the observer programs are programmed to observe activities on a computer 
system and to create log data." 

As shown, neither Togawa nor Drake teach or suggest all of the following claim 
limitations: "observer data comprising a plurality of observer program characteristics descriptive 
of a plurality of observer programs where the observer programs are programmed to observe 
activities on a computer system and to create log data." 

Claim 1 also recites "comparing instructions that compare the plurality of observer 

program characteristics with memory data characteristics to determine whether an observer 

program is present on the computer." Togawa does not teach or suggest this claim limitation. 

The Office Action has cited a portion of Togawa as teaching or suggesting this claim element. 

This portion of Togawa is as follows: 

FIG. 1 illustrates in flow chart a virus extermination method according to an 
aspect of the present invention. Referring to FIG. 1. the virus extermination 
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method illustrated includes a virus detection and identification step SI, a memory 
clearing step S3, an operating system fetching and starting up step S4 and a virus 
extermination step S5 in order to exterminate a computer virus as a software 
destroying factor which infects a computer system. 

More particularly, in the virus detection and identification step SI, a computer 
virus as a software destroying factor which infects a computer system is detected 
and a type of the computer virus is identified. If such an infecting computer virus 
is detected in the virus detection and identification step SI (the YES route of step 
S2), then information stored in all of those areas of a memory which are in a 
write-enabled state in an ordinary operation of the computer system is cleared in 
the memory clearing step S3. 

Togawa, Col. 8, lines 14-30. 

This portion of Togawa does not teach or suggest "comparing instructions that compare 
the plurality of observer program characteristics with memory data characteristics to determine 
whether an observer program is present on the computer." Col. 8, lines 14-30 of Togawa 
identifies "a virus detection and identification step SI," Togawa states that if "such an infecting 
computer virus is detected in the virus detection and identification step SI . . . , then information 
stored in all of those areas of a memory ... is cleared in the memory clearing step S3." 
Togawa, Col. 8, lines 25-30. This simply does not teach or suggest "comparing instructions that 
compare the plurality of observer program characteristics with memory data characteristics to 
determine whether an observer program is present on the computer." This claim limitation 
requires all of the elements therein including (1) "comparing instructions that compare the 
plurality of observer program characteristics with memory data characteristics", (2) "to 
determine whether an observer program is present on the computer." 

Togawa does not teach or suggest anything with respect to observer programs. The 
Office Action admitted this in stating that "Togawa fails to teach explicitly searching for 
observer programs." Office Action, Page 5. Applicants do not agree with the Office Action's 
characterization of Togawa as "teaching] a system for the detection and removal of computer 
malware." Office Action, Page 5. The use of the term "malware" is much broader than what 
Togawa teaches. The term "malware" cannot be found anywhere in the Togawa reference using 
a standard text search. The title of Togawa is "Virus extermination method, information 
processing apparatus and computer-readable recording medium with virus extermination 
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program recorded thereon." Togawa appears to only address virus detection and removal and, as 
a result, Applicants believe generalizing Togawa to "malware" is improper. 

As shown, neither Togawa nor Drake teach or suggest all of the limitations in claim 1 . 
As a result, Applicants respectfully request that the rejection of claim 1 be withdrawn. 

As set forth above, neither Togawa nor Drake teach or suggest all of the limitations in 
claim 1. Claims 2-20 depend directly or indirectly from claim 1. Thus, Applicants respectfully 
request that the rejection of claims 2-20 be withdrawn for at least the same reasons. 

Claim 21 includes similar limitations as claim 1 which were argued above. Thus, 
Applicants respectfully request that the rejection of claim 21 be withdrawn for at least the same 
reasons. 

Applicants respectfully asserts that claims 1-21 are patentably distinct from the cited 
references, and requests that a timely Notice of Allowance be issued in this case. If there are any 
remaining issues preventing allowance of the pending claims that may be clarified by telephone, 
the Examiner is requested to call the undersigned. 



Date: January 3, 2006 



Wesley L. Austin, Esq. 
Trapware Corporation 
1244 E. 1650 S. 
Bountiful, UT 84010 
Telephone: (801) 537-1700 



Respectfully submitted, 




Wesley L^Ausxin^ / 
Reg. No. 42,273 
Attorney for Applicant(s) 
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